Skip to content

feat: set proper description and tags on collector-created security platforms (#539) - #540

Merged
SamuelHassine merged 1 commit into
mainfrom
feat/security-platform-description-tags
Jul 26, 2026
Merged

feat: set proper description and tags on collector-created security platforms (#539)#540
SamuelHassine merged 1 commit into
mainfrom
feat/security-platform-description-tags

Conversation

@SamuelHassine

Copy link
Copy Markdown
Member

Summary

  • Full sweep on all 19 collectors that declare a collector_platform: each now provides a default platform_description (short description of the security product and how the collector uses it to validate expectations) and default platform_tags (e.g. ["edr", "microsoft"], ["siem", "splunk"], ["llm-firewall", "cisco"]) for the security platform it auto-creates, so the read-only cards are no longer empty in the Security platforms screen.
  • Every to_daemon_config() forwards the new collector_platform_description / collector_platform_tags keys to the daemon; both fields are operator-configurable (env/config override) and optional.
  • The template collector documents both fields (default None) for future collectors.

Covered: cisco-ai-defense, crowdstrike, elastic, hiddenlayer, lakera-guard, logrhythm, microsoft-defender, microsoft-sentinel, netwitness, palo-alto-cortex-xdr, palo-alto-cortex-xsoar, prisma-airs, prompt-security, qradar, sentinelone, splunk-es, tanium-threat-response, template, xtm-one. Collectors that only reference expected security platform types on payloads (openaev, atomic-red-team) do not create platform assets and are unaffected.

Requires the companion pyoaev change (OpenAEV-Platform/client-python#320) for the daemon to consume the new keys; until pyoaev is bumped the extra config hints are simply ignored, so this is safe to merge independently.

Closes #539

Test plan

  • All modified files compile; black + isort + flake8 clean
  • Smoke test: modern-style (microsoft-defender) and old-style (qradar) config models instantiate with the new defaults
  • End-to-end: ConfigLoader().to_daemon_config() exposes collector_platform_description / collector_platform_tags to the daemon
  • Visual check on a live platform once a collector runs with the updated pyoaev

Copilot AI review requested due to automatic review settings July 25, 2026 22:57

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR enhances collector-created security platform assets by ensuring they are created with meaningful default metadata (description + tags) and by forwarding those values to the daemon configuration, so Security Platform cards in the UI are no longer empty for collectors that auto-register a platform.

Changes:

  • Added default platform_description and platform_tags to collectors that create a collector_platform.
  • Updated each affected to_daemon_config() to forward collector_platform_description and collector_platform_tags to the daemon.
  • Documented the new optional configuration keys in the template collector settings model.

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated no comments.

Show a summary per file
File Description
xtm-one/xtm_one/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
xtm-one/xtm_one/configuration/collector_config_override.py Adds default platform description/tags for XTM One’s auto-created platform.
template/src/models/settings/config_loader.py Forwards platform description/tags into the daemon config hints (template pattern).
template/src/models/settings/collector_configs.py Documents optional COLLECTOR_PLATFORM_DESCRIPTION / COLLECTOR_PLATFORM_TAGS settings (defaults to None).
tanium-threat-response/tanium_threat_response/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
tanium-threat-response/tanium_threat_response/configuration/collector_config_override.py Adds default platform description/tags for Tanium Threat Response’s auto-created platform.
splunk-es/src/models/configs/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
sentinelone/src/models/configs/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
qradar/src/models/configs/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
prompt-security/prompt_security/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
prompt-security/prompt_security/configuration/collector_config_override.py Adds default platform description/tags for Prompt Security’s auto-created platform.
prisma-airs/prisma_airs/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
prisma-airs/prisma_airs/configuration/collector_config_override.py Adds default platform description/tags for Prisma AIRS’ auto-created platform.
palo-alto-cortex-xsoar/src/models/settings/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
palo-alto-cortex-xdr/src/models/settings/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
netwitness/src/models/configs/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
microsoft-sentinel/microsoft_sentinel/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
microsoft-sentinel/microsoft_sentinel/configuration/collector_config_override.py Adds default platform description/tags for Microsoft Sentinel’s auto-created platform.
microsoft-defender/microsoft_defender/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
microsoft-defender/microsoft_defender/configuration/collector_config_override.py Adds default platform description/tags for Microsoft Defender for Endpoint’s auto-created platform.
logrhythm/src/models/configs/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
lakera-guard/lakera_guard/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
lakera-guard/lakera_guard/configuration/collector_config_override.py Adds default platform description/tags for Lakera Guard’s auto-created platform.
hiddenlayer/hiddenlayer/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
hiddenlayer/hiddenlayer/configuration/collector_config_override.py Adds default platform description/tags for HiddenLayer AIDR’s auto-created platform.
elastic/src/models/configs/config_loader.py Adds defaults for description/tags and forwards them into the daemon config hints.
crowdstrike/crowdstrike/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
crowdstrike/crowdstrike/configuration/collector_config_override.py Adds default platform description/tags for CrowdStrike Falcon’s auto-created platform.
cisco-ai-defense/cisco_ai_defense/configuration/config_loader.py Forwards platform description/tags into the daemon config hints.
cisco-ai-defense/cisco_ai_defense/configuration/collector_config_override.py Adds default platform description/tags for Cisco AI Defense’s auto-created platform.

@SamuelHassine
SamuelHassine merged commit f50e5c5 into main Jul 26, 2026
33 checks passed
@SamuelHassine
SamuelHassine deleted the feat/security-platform-description-tags branch July 26, 2026 01:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Set proper description and tags on collector-created security platforms

3 participants